OK, this works for me and I finally understand why :). The problem is
that whatever file make sees (as a target or dependency) first, it will
prefer it for the purpose of VPATH search, so the right signing_key.x509
must come first. Unfortunately, using 'vpath %.x509' does not do the
trick, because this merely says not to use any special VPATH for files
matching this pattern, but it does not avoid the global VPATH.